There is a category of consumer gadget that gets written off as somebody else's problem: the twenty-pound Android TV box that promises every channel for a one-off fee. It is a home entertainment story, filed under things you warn your relatives about. New research this month is a good reminder that it is also a security-architecture story, and the enterprise half of it is the part nobody covers.
The short version of the reporting, from KrebsOnSecurity and the security firm Bitsight, is this. A researcher registered an expired domain that a popular family of these boxes, sold under the H96 name, used to phone home. Through it he watched tens of thousands of devices doing two jobs that have nothing to do with streaming. While the television is on, the box rents your home internet connection out to paying strangers as a residential proxy. While the television is off, the same box pretends to be a mobile phone and clicks on advertisements across a network of machine-generated junk websites, defrauding advertisers at an estimated scale of tens of thousands of dollars a day.
That is a neat piece of research and a genuine consumer warning. But if you run security for an organisation, four things in it should stop you, and none of them are about your relatives' televisions.
Residential IP addresses just stopped being trustworthy
A large amount of fraud and abuse tooling rests on a quiet assumption: traffic from a residential internet address is probably a real person, and traffic from a data centre is probably a bot. Risk engines score it that way. Login defences weight it that way. Bot mitigation, credential-stuffing defences and geofencing all lean on the idea that a home broadband address carries a human on the end of it.
Residential proxy malware breaks that assumption at scale. When tens of thousands of TV boxes, and as the reporting notes, other cheap devices like digital photo frames, are quietly reselling their home connections, an attacker can route account-takeover attempts, scraping, scalping and fraud through a clean-looking residential address in the right city. The traffic inherits the trust of the household it is passing through. Your controls see a suburban broadband line. Behind it is a criminal renting that line by the hour.
The practical consequence for a defender is that "residential, therefore low risk" is a weakening signal, and anywhere you rely on it, you are now inheriting the reputation of every compromised device on that address space. This is not a reason to panic-block residential ranges, which would break legitimate users. It is a reason to stop treating the residential label as a proxy for trust, and to lean harder on signals that describe behaviour rather than origin.
Shadow IoT is now shadow infrastructure
The second thing worth sitting with is what one of these devices actually is once it is plugged in. It is a cheap Linux computer running an unofficial build of Android, with no authentication, poor or no update integrity, and, in these cases, malware installed before it left the factory. It is designed to talk to the internet constantly, and it is designed to be invisible on your network because that is exactly what a media player looks like.
Now place that device somewhere it plausibly ends up. A television in a reception area. A screen in a meeting room that someone kitted out on a budget. A break room. And, most importantly in 2026, a home office, on the same flat network as the laptop that connects to your corporate systems over a VPN or a SASE agent. The remote-work shift quietly dissolved the boundary between the home LAN and the corporate one, and most home networks are a single flat segment where the work laptop, the smart TV, the doorbell and the preinfected streaming stick all sit together with full line of sight to each other.
An unauthenticated device with known-bad software on the same segment as a corporate endpoint is a lateral-movement opportunity that your security programme never assessed, because it never knew the device existed. This is the same shadow-IT problem the industry has chased for a decade, except the shadow asset is not an unsanctioned SaaS app, it is a physical computer with a network cable, and it arrived hostile.
This is a hardware supply-chain problem wearing a consumer costume
The detail that elevates this from "cheap gadgets are insecure" to something structural is that the malware was preinstalled. The devices did not get compromised in the field by a clever attacker. They shipped that way, through legitimate retail, with the residential proxy and fraud software baked into the firmware and, in the reporting, an app store that reinstalls the vendor's own components even after a user removes them.
That is a hardware supply-chain integrity failure, and it rhymes exactly with the software supply-chain arguments I have made elsewhere about provenance and signing. There, the question is whether you can prove an artefact was built by the pipeline you expect. Here, the question is whether you can trust the operating system on a device you bought, and for an uncertified box the answer is that you cannot, because there is no chain of provenance for the firmware at all. The certification schemes exist precisely to provide that chain: a device carrying official Android TV OS and Play Protect certification has passed a process the generic box has bypassed entirely.
The uncomfortable part is that legitimacy of the retailer tells you nothing. These devices sell through the same large, trusted marketplaces as everything else. The trust you place in the storefront does not extend to the provenance of the firmware inside the product, and treating "sold by a reputable retailer" as assurance is the consumer-grade version of trusting an unsigned artefact because it came from a familiar registry.
What to actually do about it
The response splits by who you are protecting, but the principle is one line: treat any uncertified IoT device as hostile until proven otherwise, and design the network so that being hostile does not get it anywhere.
For the organisation
- Procurement. Put a line in the device policy: screens and media players must run certified Android TV OS, or an equivalent with a real provenance chain. No generic boxes, whatever the price. This is cheaper than any incident and it is a purchasing decision, not a project.
- Segmentation. Every IoT and AV device belongs on a separate VLAN or SSID with no lateral path to corporate systems and no inter-device trust. If a compromised screen can only see the internet and not your file server, most of the risk evaporates.
- Egress control. These devices betray themselves in their outbound traffic: constant telemetry, proxy relays, connections to destinations a television has no business reaching. Filter and log egress on the segments that hold them, and alert on the patterns rather than trying to enumerate every bad device.
For the remote workforce
- Guidance, not a ban you cannot enforce. You will not police what people plug in at home. You can tell them plainly why the cheap streaming box is a bad idea on the network their work laptop uses, and you can give the ones who want the convenience a safe alternative, which is a certified device.
- Assume the home LAN is hostile. This is the honest end state, and it is just zero trust applied to the place most of your workforce now operates. The corporate endpoint should not trust the network it sits on, at home any more than in a coffee shop. Host-based controls, a properly configured client, and access that depends on device and identity rather than network location are what make the preinfected stick down the hall irrelevant.
The honest summary
The streaming-stick story is entertaining because it is vivid: your television, quietly clicking fake adverts in the small hours and renting your address to criminals while you watch a film. But the reason it belongs on a security blog rather than only a consumer one is that it compresses three serious themes into one twenty-pound object. Residential IP reputation is eroding. The home network is now part of your attack surface. And hardware provenance is as real a problem as software provenance, with far less tooling to address it.
None of the fixes are exotic. Certified devices, segmented networks, controlled egress, and a corporate endpoint that does not trust the LAN it sits on. What the cheap TV box does is make abstract advice concrete, by giving you a specific, cheap, widely sold example of exactly the device your architecture should already assume is present and hostile.
If you want help getting IoT and home-office risk under control, or building the segmentation and zero-trust access that makes an untrusted network safe to sit on, that is the kind of work I do through Cyber Spartans.